Your team needs Copilot to answer questions about internal procedures, but security policy forbids storing that data in Microsoft 365. You are not just choosing a tool; you are choosing an architectural model. The decision between synced and federated Graph connectors determines whether your content is indexed in Microsoft Graph or remains in the original source. For regulated environments, this distinction defines the boundary of Copilot security. We examine how each model handles data movement and what that means for internal content indexing.
The Data Movement Divide: Synced vs. Federated Connectors
Graph connectors serve as the bridge between external systems and Microsoft 365 Copilot, but they handle data movement in two distinct ways. The core architectural difference lies in where the content is processed. Synced connectors ingest and index data into Microsoft Graph. Federated connectors retrieve it in real time via the Model Context Protocol (MCP) without storing it in the Microsoft Graph API.
Structural Differences
Synced connectors create a persistent copy of your external content within Microsoft Graph. This approach enables semantic indexing, allowing the system to understand context and relationships rather than just matching keywords. In contrast, federated connectors act as a live bridge. They query the source system directly at the moment a user asks a question. This keeps the data in its original location and ensures that every response reflects the most current state of the information.
Comparison of Models
The table below outlines the key technical distinctions between the two models.
| Feature | Synced Connectors | Federated Connectors |
|---|---|---|
| Data Movement | Ingests and indexes into Microsoft Graph | Real-time retrieval via MCP (no indexing) |
| Schema | Uses the externalItem schema |
Defined via MCP server tools |
| Auth Method | Microsoft Entra ID app registration | OAuth 2.0 or service-specific credentials |
| Retrieval | Indexed search and synthesis | Real-time API calls |
| Use Case | Knowledge repositories for semantic search | Dynamic or regulated data requiring source residency |
Practical Implications
The choice between these models defines the scope of your Copilot security posture. If your team needs to perform approximate matches or contextual searches across a static knowledge base, the synced model’s indexing in Microsoft Graph is the standard approach. However, if your data is highly dynamic or governed by strict residency policies that prohibit data leaving the source system, federated connectors are the necessary solution. In this scenario, the connector does not create a copy. It simply facilitates a secure, real-time conversation between the user and the data source, preserving data sovereignty while still providing AI-assisted answers.
Why Semantic Indexing Matters for Internal Content Retrieval
Synced Graph connectors transform raw text into searchable knowledge by using semantic indexing. Unlike traditional keyword matching, this process allows the system to understand meaning, context, and relationships between data points. When a user asks a question in natural language, the engine looks for approximate matches rather than exact word-for-word hits. This capability is critical for internal content indexing, as it ensures that Copilot can retrieve relevant documents even when the query terminology differs from the source material.
Optimizing Indexed Properties
To maximize the quality of responses, administrators must focus on how data is ingested. Synced connectors primarily index two common properties: Title and Content. While the title helps identify the document, the content property carries the substantive information used for grounding AI answers. If you are building a custom connector, the most impactful step is to ensure that content-rich text is pushed into the content field. Sparse or metadata-only entries will limit the model’s ability to reason over the data. Adding features like urlToItemResolver and user activities can improve item ranking, but the depth of the text remains the primary driver of accuracy. By structuring your data with clear, descriptive text in these fields, you directly enhance the relevance of Copilot data sources.
Managing Expectations
Semantic indexing is powerful, but it is not a universal solution for all query types. It excels in scenarios requiring contextual interpretation, such as topic-based searches or requests for approximate matches. For example, asking for “guides on employee onboarding” works well because the system understands the concept of “onboarding.” However, this approach is less effective for multi-parameter queries or requests for specific item counts. If a user needs an exact number of records or a complex filter with multiple conditions, the ambiguity of semantic search can lead to less precise results. Understanding these boundaries helps teams set realistic expectations. You should rely on synced connectors for broad, conceptual inquiries, but use federated models or direct API calls for strict, parameter-driven data retrieval.
Authentication and Availability: The Copilot Security Check
How Copilot authenticates with your data sources determines who can access it and where that data lives. Synced connectors require a Microsoft Entra ID app registration. This means an administrator must register an application and grant admin consent for the necessary Microsoft Graph permissions. This model creates a trusted, pre-authorized bridge into the tenant.
In contrast, federated connectors rely on methods supported by the Model Context Protocol (MCP), such as OAuth 2.0 or service-specific credentials. This approach keeps authentication at the point of use. It allows the connector to validate access dynamically without establishing a persistent identity in Microsoft Entra ID.
The Data Residency Question
The choice between these models has direct implications for Copilot security and data sovereignty. When a synced connector ingests content, a copy of that data resides in Microsoft Graph. For regulated industries like healthcare or finance, this storage shift is critical. If compliance requires that data never leaves its original system, a synced connector may be unacceptable.
Federated connectors avoid this issue by retrieving content in real time via API calls. The data remains in its source system, and only the query results are shared with Copilot. This preserves data residency while still enabling AI assistance. Teams in heavily regulated environments often find this model the only viable option for sensitive Copilot data sources.
Availability Across Cloud Environments
Microsoft offers Copilot connectors across commercial, GCC, GCCH, and DoD cloud environments. However, availability is not uniform. While synced connectors are generally available across these tiers, federated connector support varies by specific connector. Not every third-party or custom federated connector is supported in government or defense clouds.
Organizations operating in GCC or DoD environments should verify that their required Graph connectors are explicitly listed as available in their cloud tier before planning their architecture. This step prevents costly redesigns later and ensures that internal content indexing strategies align with actual deployment capabilities.
| Feature | Synced Connectors | Federated Connectors |
|---|---|---|
| Authentication | Microsoft Entra ID app registration | OAuth 2.0 or service-specific credentials via MCP |
| Data Location | Indexed in Microsoft Graph | Retained in source system |
| Security Focus | Tenant-wide access control | Real-time validation at source |
| Cloud Availability | Broad across commercial, GCC, GCCH, DoD | Varies by specific connector and cloud tier |
FAQ: Choosing the Right Copilot Data Source
Can a single tenant host both synced and federated connectors?
Yes. They serve distinct purposes, and mixing them is often the most effective strategy for comprehensive coverage. Synced connectors are best for stable knowledge repositories where semantic search provides significant value. Federated connectors are ideal for dynamic or regulated data that must remain in its original source. This dual approach allows teams to leverage the benefits of internal content indexing without compromising data residency requirements.
Do federated connectors support semantic labels?
No. Federated connectors do not support semantic indexing or the application of semantic labels. Instead, filtering and retrieval rely entirely on the real-time capabilities of the connected MCP server. If a specific data source requires label-based filtering that is not available through its API, a synced connector is the appropriate choice to enable those capabilities within the Microsoft 365 ecosystem.
How does Microsoft 365 Copilot cite content from federated connectors?
Citations reference the content returned directly from the MCP server at the time of the query. Unlike synced connectors, where citations link to items indexed in Microsoft Graph, federated citations point to the live source. This ensures that the information users see is current, reflecting the exact state of the data at the moment of retrieval rather than a previously indexed snapshot.
Architectural Implications for Enterprise AI Visibility
The connector model you choose determines the grounding of every answer Copilot generates. Synced content offers broader semantic reach, allowing the system to connect concepts across your knowledge base. Federated content ensures up-to-the-second accuracy. It maintains strict data sovereignty by keeping records in their source system.
Before committing to a model, evaluate your data sensitivity and typical query patterns. This architecture defines the hard limits of what Copilot can reason over. It dictates whether you prioritize contextual depth or real-time precision. As AI ecosystems evolve, the boundary between internal and external data becomes increasingly fluid. Teams should define their own data boundaries clearly. This ensures that visibility aligns with their specific operational and security needs.
The choice between synced and federated Graph connectors ultimately defines how your organization balances the convenience of semantic search against the security of data residency. There is no single correct answer. The right model depends on whether your team prioritizes broad contextual retrieval or strict source control. As AI systems continue to ingest more of our internal knowledge, take a moment to map out which parts of your data architecture can move and which must stay put. That boundary is where your Copilot security strategy truly begins.
